Updated detection files with recommended TA list.

2026-06-08 17:32:49 +00:00 · 2022-04-25 17:25:55 +05:50
parent 9eb9e7a88b
commit 6a8867dcda
55 changed files with 1095 additions and 1019 deletions
@@ -69,5 +69,3 @@ tags:
  - All_Changes.user
  risk_score: 36
  security_domain: threat
-  supported_tas:
-  - Splunk_TA_aws-kinesis-firehose
@@ -69,5 +69,3 @@ tags:
  - All_Changes.user
  risk_score: 30
  security_domain: threat
-  supported_tas:
-  - Splunk_TA_aws-kinesis-firehose
@@ -40,7 +40,7 @@ tags:
  analytic_story:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 80
  context:
  - Source:Endpoint
@@ -76,6 +76,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 64
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -74,6 +74,4 @@ tags:
  - Registry.user
  risk_score: 3
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -31,7 +31,7 @@ tags:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Registry Abuse
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 100
  context:
  - Source:Endpoint
@@ -67,6 +67,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -64,8 +64,6 @@ tags:
  - Registry.dest
  - Registry.registry_value_name
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
  confidence: 50
  impact: 50
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -70,6 +70,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -70,6 +70,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -69,6 +69,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -69,6 +69,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -63,8 +63,6 @@ tags:
  - Registry.dest
  - Registry.registry_value_name
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
  confidence: 50
  impact: 50
@@ -68,6 +68,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 40
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -70,6 +70,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -74,6 +74,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 40
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -72,6 +72,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 25
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 25
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -72,6 +72,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 25
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -73,6 +73,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 42
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -68,6 +68,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -38,7 +38,7 @@ tags:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Registry Abuse
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 100
  context:
  - Source:Endpoint
@@ -76,6 +76,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 90
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -79,6 +79,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -35,7 +35,7 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
  analytic_story:
-  - Double Zero Destructor 
+  - Double Zero Destructor
  - Data Destruction
  - XMRig
  - Remcos
@@ -82,6 +82,4 @@ tags:
  - Filesystem.user
  risk_score: 56
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -28,7 +28,7 @@ tags:
  analytic_story:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 100
  context:
  - Source:Endpoint
@@ -64,6 +64,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -74,3 +74,5 @@ tags:
  - Processes.parent_process_name
  risk_score: 36
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -55,8 +55,6 @@ tags:
  - Filesystem.user
  - Filesystem.file_path
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
  confidence: 50
  impact: 50
@@ -98,5 +98,3 @@ tags:
  - Registry.user
  risk_score: 76
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
@@ -62,6 +62,4 @@ tags:
  - Registry.user
  risk_score: 90
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_key_name
  risk_score: 60
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -86,3 +86,5 @@ tags:
  - Processes.parent_process_name
  risk_score: 36
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -82,3 +82,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -32,7 +32,7 @@ tags:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Registry Abuse
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 90
  context:
  - Source:Endpoint
@@ -68,6 +68,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 72
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -94,5 +94,3 @@ tags:
  - cmd_line
  risk_score: 56
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
@@ -39,7 +39,7 @@ tags:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Registry Abuse
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 100
  context:
  - Source:Endpoint
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -74,6 +74,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 64
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -6,13 +6,15 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. 
-  This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. 
-  This technique was used by threat actor to make its payload more impactful to the compromised host.
+description: This analytic is to detect a suspicious registry modification to disable
+  Lock Computer windows features. This registry modification prevent the user from
+  locking its screen or computer that are being abused by several malware for example
+  ransomware. This technique was used by threat actor to make its payload more impactful
+  to the compromised host.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation"
-  Registry.registry_value_data = "0x00000001"
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
@@ -21,15 +23,14 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
  proc_guid | fields _time dest user parent_process_name parent_process process_name
  process_path process proc_guid registry_path registry_value_name registry_value_data]
  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data 
-  | `windows_disable_lock_workstation_feature_through_registry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_lock_workstation_feature_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 known_false_positives: unknown
 references:
-  https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/
-  https://heimdalsecurity.com/blog/fatalrat-targets-telegram/
+- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/
+- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/
 tags:
  analytic_story:
  - Ransomware
@@ -51,17 +52,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -78,4 +78,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,33 +6,35 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. 
-  This registry when enable will prevent users to log off of the system by using any method, 
-  including programs run from the command line, such as scripts. It also disables or removes 
-  all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware 
-  to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect.
-  This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
-  and users that can modify this registry is needed.
+description: This analytic is to detect a suspicious registry modification to disable
+  logoff feature in windows host. This registry when enable will prevent users to
+  log off of the system by using any method, including programs run from the command
+  line, such as scripts. It also disables or removes all menu items and buttons that
+  log the user off of the system. This technique was seen abused by ransomware malware
+  to make the compromised host un-useful and hard to remove other registry modification
+  made on the machine that needs restart to take effect. This windows feature may
+  implement by administrator in some server where shutdown is critical. In that scenario
+  filter of machine and users that can modify this registry is needed.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" 
-  Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff")
-  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
-  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
-  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
-  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
-  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
-  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
-  proc_guid | fields _time dest user parent_process_name parent_process process_name
-  process_path process proc_guid registry_path registry_value_name registry_value_data]
-  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data
-  | `windows_disable_logoff_button_through_registry_filter`'
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
+  Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data
+  = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name
+  parent_process process_name process_path process proc_guid registry_path registry_value_name
+  registry_value_data | `windows_disable_logoff_button_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
-known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
-  and users that can modify this registry is needed.
+known_false_positives: This windows feature may implement by administrator in some
+  server where shutdown is critical. In that scenario filter of machine and users
+  that can modify this registry is needed.
 references:
 - https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774
 - https://malwiki.org/index.php?title=DigiPop.xp
@@ -57,17 +59,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -84,4 +85,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,16 +6,18 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. 
-  This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host 
-  un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. 
-  This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
-  and users that can modify this registry is needed.
+description: This analytic is to detect a suspicious registry modification to disable
+  shutdown button on the logon user. This technique was seen in several malware especially
+  in ransomware family like killdisk malware variant to make the compromised host
+  un-useful and hard to remove other registry modification made on the machine that
+  needs restart to take effect. This windows feature may implement by administrator
+  in some server where shutdown is critical. In that scenario filter of machine and
+  users that can modify this registry is needed.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
-  Registry.registry_value_data = "0x00000000") 
-  OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001") 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
+  Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
@@ -24,15 +26,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
  proc_guid | fields _time dest user parent_process_name parent_process process_name
  process_path process proc_guid registry_path registry_value_name registry_value_data]
  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data
-  | `windows_disable_shutdown_button_through_registry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_shutdown_button_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
-known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
-  and users that can modify this registry is needed.
+known_false_positives: This windows feature may implement by administrator in some
+  server where shutdown is critical. In that scenario filter of machine and users
+  that can modify this registry is needed.
 references:
-  https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/
+- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/
 tags:
  analytic_story:
  - Ransomware
@@ -53,17 +55,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -80,4 +81,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,16 +6,20 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to disable windows features. 
-  These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response 
-  from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but 
-  can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed.
+description: This analytic is to detect a suspicious registry modification to disable
+  windows features. These techniques are seen in several ransomware malware to impair
+  the compromised host to make it hard for analyst to mitigate or response from the
+  attack. Disabling these known features make the analysis and forensic response more
+  hard. Disabling these feature is not so common but can still be implemented by the
+  administrator for security purposes. In this scenario filters for users that are
+  allowed doing this is needed.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*"
-  Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", 
-  "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments")
-  Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
+  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*"
+  Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu",
+  "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments")
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
@@ -24,8 +28,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
  proc_guid | fields _time dest user parent_process_name parent_process process_name
  process_path process proc_guid registry_path registry_value_name registry_value_data]
  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data 
-  | `windows_disable_windows_group_policy_features_through_registry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_windows_group_policy_features_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
@@ -55,17 +58,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -82,4 +84,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -68,5 +68,3 @@ tags:
  - Registry.registry_path
  risk_score: 24
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
@@ -6,30 +6,32 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. 
-  This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and 
-  ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed.
+description: This analytic is to detect a suspicious registry modification to hide
+  common windows notification feature from compromised host. This technique was seen
+  in some ransomware family to add more impact to its payload that are visually seen
+  by user aside from the encrypted files and ransomware notes. Even this a good anomaly
+  detection, administrator may implement this changes for auditing or security reason.
+  In this scenario filter is needed.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" 
-  Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume")
-  Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
-  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
-  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
+  Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork",
+  "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001" by
+  _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
  proc_guid | fields _time dest user parent_process_name parent_process process_name
  process_path process proc_guid registry_path registry_value_name registry_value_data]
  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data 
-  | `windows_hide_notification_features_through_registry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_hide_notification_features_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 known_false_positives: unknown
 references:
-  https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/
+- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/
 tags:
  analytic_story:
  - Ransomware
@@ -51,17 +53,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -78,4 +79,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -7,25 +7,25 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic detects programs that have been started by forfiles.exe.
-  According to Microsoft, the 'The forfiles command lets you run a command on or pass 
+  According to Microsoft, the 'The forfiles command lets you run a command on or pass
  arguments to multiple files'. While this tool can be used to start legitimate programs,
-  usually within the context of a batch script, it has been observed being used to evade 
-  protections on command line execution.
+  usually within the context of a batch script, it has been observed being used to
+  evade protections on command line execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *"  
-    by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_indirect_command_execution_via_forfiles_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles*
+  /c *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_forfiles_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the full process path in the process field of CIM's Process data model.
  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
  Tune and filter known instances where  forfiles.exe may be used.
-known_false_positives: Some legacy applications may be run using pcalua.exe.  
-  Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.  
+known_false_positives: Some legacy applications may be run using pcalua.exe. Similarly,
+  forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.
 references:
-  - https://twitter.com/KyleHanslovan/status/912659279806640128
-  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
+- https://twitter.com/KyleHanslovan/status/912659279806640128
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
 tags:
  analytic_story:
  - Living Off The Land
@@ -43,21 +43,20 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
-  - Processes.parent_process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
  - Processes.process_path
  security_domain: endpoint
  impact: 50
-  confidence: 50 
-  # (impact * confidence)/100
+  confidence: 50
  risk_score: 25
-  context: 
+  context:
  - Source:Endpoint
  - Stage:Defense Evasion
  message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
@@ -70,5 +69,7 @@ tags:
  - DE.AE
  cis20:
  - CIS 8
-  - CIS 10 
+  - CIS 10
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,24 +6,25 @@ author: Eric McGinnis, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic detects programs that have been started by pcalua.exe.  
-  pcalua.exe is the Microsoft Windows Program Compatability Assistant.  While this tool 
-  can be used to start legitimate programs, it has been observed being used to evade 
-  protections on command line execution.
+description: The following analytic detects programs that have been started by pcalua.exe.
+  pcalua.exe is the Microsoft Windows Program Compatability Assistant.  While this
+  tool can be used to start legitimate programs, it has been observed being used to
+  evade protections on command line execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* -a*"  
-    by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_indirect_command_execution_via_pcalua_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua*
+  -a*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_pcalua_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the full process path in the process field of CIM's Process data model.
  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
  Tune and filter known instances where pcalua.exe may be used.
-known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter these results as needed.  
+known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter
+  these results as needed.
 references:
-  - https://twitter.com/KyleHanslovan/status/912659279806640128
-  - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
+- https://twitter.com/KyleHanslovan/status/912659279806640128
+- https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
 tags:
  analytic_story:
  - Living Off The Land
@@ -41,21 +42,20 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
-  - Processes.parent_process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
  - Processes.process_path
  security_domain: endpoint
  impact: 50
-  confidence: 50 
-  # (impact * confidence)/100
+  confidence: 50
  risk_score: 25
-  context: 
+  context:
  - Source:Endpoint
  - Stage:Defense Evasion
  message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
@@ -68,5 +68,7 @@ tags:
  - DE.AE
  cis20:
  - CIS 8
-  - CIS 10 
+  - CIS 10
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -74,3 +74,5 @@ tags:
  risk_score: 25
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -76,3 +76,5 @@ tags:
  risk_score: 49
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -79,3 +79,5 @@ tags:
  risk_score: 80
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -76,3 +76,5 @@ tags:
  risk_score: 80
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -73,3 +73,5 @@ tags:
  risk_score: 48
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -1,317 +1,331 @@
 detection_name,cim_version,supported_tas,tas_with_cim_mapping
-abnormally_high_number_of_cloud_security_group_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
-cloud_api_calls_from_previously_unseen_user_roles,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce"
-cloud_compute_instance_created_in_previously_unused_region,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose
-cloud_provisioning_from_previously_unseen_country,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
-cloud_compute_instance_created_with_previously_unseen_instance_type,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose
-cloud_compute_instance_created_by_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose
-cloud_provisioning_from_previously_unseen_region,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
-abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
-cloud_compute_instance_created_with_previously_unseen_image,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose
-cloud_provisioning_from_previously_unseen_city,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
-cloud_provisioning_from_previously_unseen_ip_address,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce"
-cloud_instance_modified_with_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce"
-linux_setuid_using_chmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-disabling_folderoptions_windows_feature,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-anomalous_usage_of_7zip,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-enable_rdp_in_other_port_number,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-excessive_number_of_taskhost_processes,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
-xsl_script_execution_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-rundll32_control_rundll_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-disable_schedule_task,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-serviceprincipalnames_discovery_with_setspn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-allow_operation_with_consent_admin,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-windows_service_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-spoolsv_writing_a_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-dsquery_domain_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-linux_possible_access_or_modification_of_sshd_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-secretdumps_offline_ntds_dumping_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-attacker_tools_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
-domain_account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-certutil_exe_certificate_extraction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_html_help_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-prevent_automatic_repair_mode_using_bcdedit,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-linux_possible_access_to_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-get_domainpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-excessive_number_of_distinct_processes_created_in_windows_temp_folder,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm"
-disable_registry_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-powershell_disable_security_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-svchost_exe_lolbas_execution_process_spawn,5.0.0,,Splunk_TA_microsoft_sysmon
-disable_defender_spynet_reporting,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-certutil_download_with_verifyctl_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-windows_nirsoft_advancedrun,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-cmd_echo_pipe___escalation,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-excessive_number_of_service_control_start_as_disabled,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-windows_installutil_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-suspicious_icedid_rundll32_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-excessive_service_stop_attempt,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_copy_on_system32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-credential_dumping_via_symlink_to_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_searchprotocolhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-excessive_usage_of_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-permission_modification_using_takeown_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-linux_at_application_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-reg_exe_manipulating_windows_services_registry_keys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-logon_script_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-linux_possible_ssh_key_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-dump_lsass_via_procdump,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-getwmiobject_ds_computer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-sdclt_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-hide_user_account_from_sign_in_screen,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-deleting_of_net_users,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-revil_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-detect_psexec_with_accepteula_flag,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-remote_process_instantiation_via_dcom_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-auto_admin_logon_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-linux_doas_tool_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-modify_acl_permission_to_files_or_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-getdomaingroup_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-disable_amsi_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-wermgr_process_spawned_cmd_or_powershell_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_azurehound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-office_product_spawning_rundll32_with_no_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_exchange_web_shell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-time_provider_persistence_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-system_processes_run_from_unexpected_locations,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-scheduled_task_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-sc_exe_manipulating_windows_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-disable_defender_submit_samples_consent_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-ryuk_wake_on_lan_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-suspicious_msbuild_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_possible_access_to_credential_files,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-suspicious_wevtutil_usage,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-excessive_usage_of_cacls_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-disabling_task_manager,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-office_document_spawned_child_process_to_download,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-processes_launching_netsh,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-linux_possible_append_command_to_at_allow_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-single_letter_process_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm"
-check_elevated_cmd_using_whoami,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-short_lived_windows_accounts,5.0.0,,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark"
-possible_lateral_movement_powershell_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-schtasks_scheduling_job_on_remote_system,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-executables_or_script_creation_in_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-active_setup_registry_autostart,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-suspicious_rundll32_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-winword_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_regsvr32_register_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_install_kernel_module_using_modprobe_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-scheduled_task_creation_on_remote_endpoint_using_at,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_possible_append_command_to_profile_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-nishang_powershelltcponeline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_mshta_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_sudoers_tmp_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-linux_service_restarted,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-disabling_defender_services,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-getwmiobject_ds_group_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-firewall_allowed_program_enable,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-office_application_spawn_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_rundll32_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_gpupdate_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-extraction_of_registry_hives,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-powershell_start_bitstransfer,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_mshta_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_rundll32_application_control_bypass___setupapi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-recursive_delete_of_directory_in_batch_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-get_aduserresultantpasswordpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-windows_dotnet_binary_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-net_profiler_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-disable_etw_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-remote_process_instantiation_via_winrm_and_winrs,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-office_product_spawning_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-execution_of_file_with_multiple_extensions,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
-remote_process_instantiation_via_winrm_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_process_file_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-any_powershell_downloadstring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_change_file_owner_to_root,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-process_creating_lnk_file_in_suspicious_location,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-wbadmin_delete_system_backups,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-linux_pkexec_privilege_escalation,5.0.0,,Splunk_TA_microsoft_sysmon
-disabling_controlpanel,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-attempt_to_stop_security_service,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-excel_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-allow_inbound_traffic_by_firewall_rule_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-getdomaincomputer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-malicious_powershell_process___execution_policy_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-disable_defender_enhanced_notification,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-fodhelper_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-detect_regsvr32_application_control_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-windows_curl_download_to_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-remcos_client_registry_install_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_microsoft_workflow_compiler_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-bcdedit_failure_recovery_modification,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-linux_service_file_created_in_systemd_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-slui_runas_elevated,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-batch_file_write_to_system32,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
-windows_dism_remove_defender,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-excessive_usage_of_taskkill,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-nltest_domain_trust_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-fsutil_zeroing_file,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-office_application_spawn_rundll32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-add_or_set_windows_defender_exclusion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-bitsadmin_download_file,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-print_processor_registry_autostart,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-detect_path_interception_by_creation_of_program_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-cmdline_tool_not_executed_in_cmd_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_mshta_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_rundll32_startw,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-script_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm"
-slui_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-scheduled_task_deleted_or_created_via_cmd,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-allow_network_discovery_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_file_created_in_kernel_driver_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-disable_logs_using_wevtutil,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-revil_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-detect_sharphound_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-wmiprsve_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_file_creation_in_profile_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-services_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-regsvr32_with_known_silent_switch_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-windows_installutil_uninstall_option,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-deleting_shadow_copies,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-winhlp32_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-disabling_firewall_with_netsh,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-elevated_group_discovery_with_net,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_setuid_using_setcap_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-linux_preload_hijack_library_calls,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-windows_installutil_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-get_foresttrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-windows_defender_exclusion_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-windows_adfind_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-disabling_cmd_application,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-msmpeng_application_dll_side_loading,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_insert_kernel_module_using_insmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-certutil_download_with_urlcache_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_msbuild_rename,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_mshta_child_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-uninstall_app_using_msiexec,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-execute_javascript_with_jscript_com_clsid,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-create_local_admin_accounts_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-disable_uac_remote_restriction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_doas_conf_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-creation_of_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_file_creation_in_init_boot_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-windows_disableantispyware_reg,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-disable_defender_mpengine_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-getwmiobject_ds_user_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-disable_windows_app_hotkeys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-dns_exfiltration_using_nslookup_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-clear_unallocated_sector_using_cipher_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_java_spawning_shell,5.0.0,,Splunk_TA_microsoft_sysmon
-disable_defender_blockatfirstseen_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-remote_process_instantiation_via_wmi_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_regsvcs_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-get_domaintrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-windows_installutil_credential_theft,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-elevated_group_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-registry_keys_used_for_persistence,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-detect_rundll32_application_control_bypass___syssetup,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-ping_sleep_batch_command,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_processes_used_for_system_network_configuration_discovery,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-clop_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-office_product_spawning_certutil,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-regsvr32_silent_and_install_param_dll_loading,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-msbuild_suspicious_spawned_by_script_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-hiding_files_and_directories_with_attrib_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
-office_product_spawn_cmd_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-wsreset_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-certutil_with_decode_argument,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-allow_file_and_printing_sharing_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-system_information_discovery_detection,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm"
-malicious_powershell_process_with_obfuscation_techniques,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_add_files_in_known_crontab_directories,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-eventvwr_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-icacls_deny_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-usn_journal_deletion,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-remote_system_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_html_help_using_infotech_storage_handlers,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-disable_security_logs_using_minint_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-sdelete_application_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-curl_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-icacls_grant_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-winword_spawning_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-credential_dumping_via_copy_command_from_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_regasm_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-enable_wdigest_uselogoncredential_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-control_loading_from_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-remote_process_instantiation_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_dllhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-spoolsv_spawning_rundll32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-conti_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-attempted_credential_dump_from_registry_via_reg_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-jscript_execution_using_cscript_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-bcdedit_command_back_to_normal_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-rundll32_shimcache_flush,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-screensaver_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-office_product_spawning_bitsadmin,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-change_default_file_association,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-wscript_or_cscript_suspicious_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-domain_controller_discovery_with_nltest,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-disable_windows_behavior_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-windows_curl_upload_to_remote_destination,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-unified_messaging_service_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-detect_html_help_spawn_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_regsvcs_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-linux_service_started_or_enabled,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-java_class_file_download_by_java_user_agent,5.0.0,,"Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa"
-linux_at_allow_config_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-disable_defender_antivirus_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_visudo_utility_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-schtasks_run_task_on_demand,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-schtasks_used_for_forcing_a_reboot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-windows_raccine_scheduled_task_deletion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-mshta_spawning_rundll32_or_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-excessive_attempt_to_disable_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-get_domainuser_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-suspicious_scheduled_task_from_public_directory,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-rundll32_with_no_command_line_arguments_with_network,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-windows_service_creation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-linux_nopasswd_entry_in_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-attempt_to_add_certificate_to_untrusted_store,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-process_kill_base_on_file_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-wsmprovhost_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-domain_account_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-disabling_norun_windows_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-suspicious_rundll32_plugininit,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-file_with_samsam_extension,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
-silentcleanup_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-ntdsutil_export_ntds,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-disabling_systemrestore_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-vbscript_execution_using_wscript_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-office_spawning_control,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_regasm_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-start_up_during_safe_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-office_product_spawning_mshta,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-change_to_safe_mode_with_network_config,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-potentially_malicious_code_on_commandline,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-detect_rundll32_application_control_bypass___advpack,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-services_escalate_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-wget_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-remote_wmi_command_attempt,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-create_or_delete_windows_shares_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-unload_sysmon_filter_driver,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-resize_shadowstorage_volume,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-wmic_xsl_execution_via_url,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_reg_exe_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-etw_registry_disabled,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-process_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-samsam_test_file_write,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
-impacket_lateral_movement_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-dump_lsass_via_comsvcs_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-creation_of_shadow_copy_with_wmic_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-overwriting_accessibility_binaries,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
-add_defaultuser_and_password_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-bits_job_persistence,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_rundll32_dllregisterserver,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-any_powershell_downloadfile,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-mmc_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-w3wp_spawning_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-detect_sharphound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
-detect_rclone_command_line_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-suspicious_msbuild_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-disabling_net_user_account,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
-shim_database_installation_with_suspicious_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
-dns_query_length_with_high_standard_deviation,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_isc-bind, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox"
+abnormally_high_number_of_cloud_security_group_api_calls,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
+cloud_api_calls_from_previously_unseen_user_roles,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce"
+cloud_compute_instance_created_in_previously_unused_region,5.0.1,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose
+cloud_provisioning_from_previously_unseen_country,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
+cloud_compute_instance_created_by_previously_unseen_user,5.0.1,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose
+cloud_provisioning_from_previously_unseen_region,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
+abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
+cloud_provisioning_from_previously_unseen_city,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce"
+cloud_provisioning_from_previously_unseen_ip_address,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce"
+cloud_instance_modified_with_previously_unseen_user,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce"
+linux_setuid_using_chmod_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+disabling_folderoptions_windows_feature,5.0.1,,Splunk_TA_bit9-carbonblack
+anomalous_usage_of_7zip,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+enable_rdp_in_other_port_number,5.0.1,,Splunk_TA_bit9-carbonblack
+excessive_number_of_taskhost_processes,5.0.1,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+xsl_script_execution_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+rundll32_control_rundll_world_writable_directory,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_kworker_process_commandline,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+disable_schedule_task,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+serviceprincipalnames_discovery_with_setspn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+allow_operation_with_consent_admin,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+windows_service_initiation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+spoolsv_writing_a_dll,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
+linux_deletion_of_cron_jobs,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+dsquery_domain_discovery,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+linux_possible_access_or_modification_of_sshd_config_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+windows_file_without_extension_in_critical_folder,5.0.1,,Splunk_TA_bit9-carbonblack
+secretdumps_offline_ntds_dumping_tool,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+attacker_tools_on_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+linux_deletion_of_ssl_certificate,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+domain_account_discovery_with_net_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+certutil_exe_certificate_extraction,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_html_help_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+prevent_automatic_repair_mode_using_bcdedit,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+linux_possible_access_to_sudoers_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+get_domainpolicy_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+disable_registry_tool,5.0.1,,Splunk_TA_bit9-carbonblack
+powershell_disable_security_monitoring,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+svchost_exe_lolbas_execution_process_spawn,5.0.1,,Splunk_TA_microsoft_sysmon
+windows_rasautou_dll_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+certutil_download_with_verifyctl_and_split_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_nirsoft_advancedrun,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+cmd_echo_pipe___escalation,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+excessive_number_of_service_control_start_as_disabled,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+windows_installutil_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_disable_memory_crash_dump,5.0.1,,Splunk_TA_bit9-carbonblack
+detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+suspicious_icedid_rundll32_cmdline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+excessive_service_stop_attempt,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_copy_on_system32,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+credential_dumping_via_symlink_to_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_indirect_command_execution_via_pcalua,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+suspicious_searchprotocolhost_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+excessive_usage_of_net_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+permission_modification_using_takeown_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+linux_at_application_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+reg_exe_manipulating_windows_services_registry_keys,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+logon_script_event_trigger_execution,5.0.1,,Splunk_TA_bit9-carbonblack
+linux_possible_ssh_key_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+dump_lsass_via_procdump,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+getwmiobject_ds_computer_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+sdclt_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+hide_user_account_from_sign_in_screen,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+deleting_of_net_users,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+revil_registry_entry,5.0.1,,Splunk_TA_bit9-carbonblack
+detect_psexec_with_accepteula_flag,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+remote_process_instantiation_via_dcom_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+auto_admin_logon_registry_entry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+linux_high_frequency_of_file_deletion_in_etc_folder,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+linux_doas_tool_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+modify_acl_permission_to_files_or_folder,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+getdomaingroup_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+disable_amsi_through_registry,5.0.1,,Splunk_TA_bit9-carbonblack
+wermgr_process_spawned_cmd_or_powershell_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_azurehound_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+office_product_spawning_rundll32_with_no_dll,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_hide_notification_features_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+detect_exchange_web_shell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
+time_provider_persistence_registry,5.0.1,,Splunk_TA_bit9-carbonblack
+system_processes_run_from_unexpected_locations,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
+scheduled_task_initiation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+sc_exe_manipulating_windows_services,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+ryuk_wake_on_lan_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+windows_remote_assistance_spawning_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_msbuild_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_possible_access_to_credential_files,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+suspicious_wevtutil_usage,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+excessive_usage_of_cacls_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+disabling_task_manager,5.0.1,,Splunk_TA_bit9-carbonblack
+office_document_spawned_child_process_to_download,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+processes_launching_netsh,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+linux_possible_append_command_to_at_allow_config_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+single_letter_process_on_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm"
+check_elevated_cmd_using_whoami,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+short_lived_windows_accounts,5.0.1,,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark"
+possible_lateral_movement_powershell_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_disable_windows_group_policy_features_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+schtasks_scheduling_job_on_remote_system,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+linux_deletion_of_services,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+executables_or_script_creation_in_suspicious_path,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR"
+active_setup_registry_autostart,5.0.1,,Splunk_TA_bit9-carbonblack
+suspicious_rundll32_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+winword_spawning_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_regsvr32_register_suspicious_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_install_kernel_module_using_modprobe_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+scheduled_task_creation_on_remote_endpoint_using_at,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_possible_append_command_to_profile_config_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+nishang_powershelltcponeline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_mshta_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_sudoers_tmp_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+suspicious_linux_discovery_commands,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+linux_service_restarted,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+getwmiobject_ds_group_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+firewall_allowed_program_enable,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+office_application_spawn_regsvr32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_rundll32_inline_hta_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_gpupdate_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+extraction_of_registry_hives,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+powershell_start_bitstransfer,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_mshta_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_rundll32_application_control_bypass___setupapi,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+recursive_delete_of_directory_in_batch_cmd,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+get_aduserresultantpasswordpolicy_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+windows_dotnet_binary_in_non_standard_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+net_profiler_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+disable_etw_through_registry,5.0.1,,Splunk_TA_bit9-carbonblack
+remote_process_instantiation_via_winrm_and_winrs,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+office_product_spawning_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+execution_of_file_with_multiple_extensions,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+remote_process_instantiation_via_winrm_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_process_file_path,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+any_powershell_downloadstring,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_change_file_owner_to_root,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+process_creating_lnk_file_in_suspicious_location,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR"
+windows_disable_lock_workstation_feature_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+wbadmin_delete_system_backups,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+linux_pkexec_privilege_escalation,5.0.1,,Splunk_TA_microsoft_sysmon
+disabling_controlpanel,5.0.1,,Splunk_TA_bit9-carbonblack
+attempt_to_stop_security_service,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+excel_spawning_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+allow_inbound_traffic_by_firewall_rule_registry,5.0.1,,Splunk_TA_bit9-carbonblack
+getdomaincomputer_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+malicious_powershell_process___execution_policy_bypass,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+fodhelper_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+detect_regsvr32_application_control_bypass,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_curl_download_to_suspicious_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_microsoft_workflow_compiler_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+bcdedit_failure_recovery_modification,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+linux_service_file_created_in_systemd_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+slui_runas_elevated,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+batch_file_write_to_system32,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+windows_dism_remove_defender,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+excessive_usage_of_taskkill,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+nltest_domain_trust_discovery,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+fsutil_zeroing_file,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+windows_modify_show_compress_color_and_info_tip_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+office_application_spawn_rundll32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+add_or_set_windows_defender_exclusion,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+bitsadmin_download_file,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_path_interception_by_creation_of_program_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+cmdline_tool_not_executed_in_cmd_shell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_mshta_inline_hta_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_rundll32_startw,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+script_execution_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm"
+slui_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+scheduled_task_deleted_or_created_via_cmd,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+allow_network_discovery_in_firewall,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_file_created_in_kernel_driver_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+disable_logs_using_wevtutil,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+revil_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+excessive_distinct_processes_from_windows_temp,5.0.1,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm"
+detect_sharphound_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+wmiprsve_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_file_creation_in_profile_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+windows_service_creation_using_registry_entry,5.0.1,,Splunk_TA_bit9-carbonblack
+services_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+regsvr32_with_known_silent_switch_cmdline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_installutil_uninstall_option,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+deleting_shadow_copies,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+winhlp32_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+disabling_firewall_with_netsh,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+elevated_group_discovery_with_net,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_setuid_using_setcap_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+linux_preload_hijack_library_calls,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+windows_installutil_in_non_standard_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+get_foresttrust_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_adfind_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+disabling_cmd_application,5.0.1,,Splunk_TA_bit9-carbonblack
+msmpeng_application_dll_side_loading,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR"
+account_discovery_with_net_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_insert_kernel_module_using_insmod_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+certutil_download_with_urlcache_and_split_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_mshta_child_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+uninstall_app_using_msiexec,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+execute_javascript_with_jscript_com_clsid,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+create_local_admin_accounts_using_net_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_disable_shutdown_button_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+linux_doas_conf_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+creation_of_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_disable_logoff_button_through_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+linux_file_creation_in_init_boot_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+windows_disableantispyware_reg,5.0.1,,Splunk_TA_bit9-carbonblack
+getwmiobject_ds_user_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+disable_windows_app_hotkeys,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+dns_exfiltration_using_nslookup_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+clear_unallocated_sector_using_cipher_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_java_spawning_shell,5.0.1,,Splunk_TA_microsoft_sysmon
+remote_process_instantiation_via_wmi_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_regsvcs_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+get_domaintrust_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_installutil_credential_theft,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+elevated_group_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+registry_keys_used_for_persistence,5.0.1,,Splunk_TA_bit9-carbonblack
+detect_rundll32_application_control_bypass___syssetup,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+ping_sleep_batch_command,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_system_network_discovery,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+detect_processes_used_for_system_network_configuration_discovery,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+clop_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+office_product_spawning_certutil,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+regsvr32_silent_and_install_param_dll_loading,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+rubeus_command_line_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+msbuild_suspicious_spawned_by_script_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+hiding_files_and_directories_with_attrib_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+office_product_spawn_cmd_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+wsreset_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+certutil_with_decode_argument,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+allow_file_and_printing_sharing_in_firewall,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+system_information_discovery_detection,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm"
+malicious_powershell_process_with_obfuscation_techniques,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_add_files_in_known_crontab_directories,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+eventvwr_uac_bypass,5.0.1,,Splunk_TA_bit9-carbonblack
+icacls_deny_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+usn_journal_deletion,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+remote_system_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_html_help_using_infotech_storage_handlers,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+sdelete_application_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+curl_download_and_bash_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+icacls_grant_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+rundll_loading_dll_by_ordinal,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+winword_spawning_cmd,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_disable_change_password_through_registry,5.0.1,,Splunk_TA_bit9-carbonblack
+credential_dumping_via_copy_command_from_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_regasm_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+control_loading_from_world_writable_directory,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+remote_process_instantiation_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_dllhost_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+spoolsv_spawning_rundll32,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+conti_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+attempted_credential_dump_from_registry_via_reg_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+jscript_execution_using_cscript_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+bcdedit_command_back_to_normal_mode_boot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+rundll32_shimcache_flush,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+screensaver_event_trigger_execution,5.0.1,,Splunk_TA_bit9-carbonblack
+office_product_spawning_bitsadmin,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+change_default_file_association,5.0.1,,Splunk_TA_bit9-carbonblack
+linux_deletion_of_ssh_key,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+wscript_or_cscript_suspicious_child_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+domain_controller_discovery_with_nltest,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+disable_windows_behavior_monitoring,5.0.1,,Splunk_TA_bit9-carbonblack
+windows_curl_upload_to_remote_destination,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+unified_messaging_service_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+detect_html_help_spawn_child_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_regsvcs_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+linux_service_started_or_enabled,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+java_class_file_download_by_java_user_agent,5.0.1,,"Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa"
+linux_at_allow_config_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+linux_stdout_redirection_to_dev_null_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+linux_visudo_utility_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+schtasks_run_task_on_demand,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+linux_iptables_firewall_modification,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+schtasks_used_for_forcing_a_reboot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+windows_raccine_scheduled_task_deletion,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+mshta_spawning_rundll32_or_regsvr32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+mimikatz_passtheticket_commandline_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+excessive_attempt_to_disable_services,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+get_domainuser_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+suspicious_scheduled_task_from_public_directory,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+rundll32_with_no_command_line_arguments_with_network,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_service_creation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_nopasswd_entry_in_sudoers_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+attempt_to_add_certificate_to_untrusted_store,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+process_kill_base_on_file_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+linux_deletion_of_init_daemon_script,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+wsmprovhost_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+domain_account_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+linux_dd_file_overwrite,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+disabling_norun_windows_app,5.0.1,,Splunk_TA_bit9-carbonblack
+suspicious_rundll32_plugininit,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+file_with_samsam_extension,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+silentcleanup_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+ntdsutil_export_ntds,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+disabling_systemrestore_in_registry,5.0.1,,Splunk_TA_bit9-carbonblack
+vbscript_execution_using_wscript_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+office_spawning_control,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_regasm_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+start_up_during_safe_mode_boot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+office_product_spawning_mshta,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+change_to_safe_mode_with_network_config,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+potentially_malicious_code_on_commandline,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+detect_rundll32_application_control_bypass___advpack,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+services_escalate_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+wget_download_and_bash_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+remote_wmi_command_attempt,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+create_or_delete_windows_shares_using_net_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+unload_sysmon_filter_driver,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+resize_shadowstorage_volume,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+windows_indirect_command_execution_via_forfiles,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+wmic_xsl_execution_via_url,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_reg_exe_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+process_execution_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+samsam_test_file_write,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+impacket_lateral_movement_commandline_parameters,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+windows_process_with_namedpipe_commandline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+dump_lsass_via_comsvcs_dll,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+creation_of_shadow_copy_with_wmic_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+overwriting_accessibility_binaries,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+windows_schtasks_create_run_as_system,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+add_defaultuser_and_password_in_registry,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon"
+bits_job_persistence,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_rundll32_dllregisterserver,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+any_powershell_downloadfile,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+mmc_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+w3wp_spawning_shell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+detect_sharphound_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows"
+detect_rclone_command_line_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+suspicious_msbuild_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+disabling_net_user_account,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon
+shim_database_installation_with_suspicious_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR"
+dns_query_length_with_high_standard_deviation,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_isc-bind, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox"